[Bug 220823] security/strongswan: [security] Update to the latest version (v5.5.3), current (v5.5.2) is vulnerable

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=220823

            Bug ID: 220823
           Summary: security/strongswan: [security] Update to the latest
                    version (v5.5.3), current (v5.5.2) is vulnerable
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Many People
          Priority: ---
         Component: Individual Port(s)
          Assignee: freebsd-ports-bugs at FreeBSD.org
          Reporter: i.dani at outlook.com
                CC: strongswan at Nanoteq.com
                CC: strongswan at Nanoteq.com
             Flags: maintainer-feedback?(strongswan at Nanoteq.com)

The current version avilable for FreeBSD is vulnerable since 30.05.2017 and has
already been patched upstream. The current contains two DoS-vuln's.

Changelog: https://wiki.strongswan.org/versions/65

Available version: 5.5.2
Patched version: 5.5.3

Security:
- Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient
input validation when verifying RSA signatures. More specifically,
mpz_powm_sec() has two requirements regarding the passed exponent and modulus
that the plugin did not enforce, if these are not met the calculation will
result in a floating point exception that crashes the whole process.

This vulnerability has been registered as CVE-2017-9022 [1].
Please refer to our blog for details. [2]

- Fixed a DoS vulnerability in the x509 plugin that was caused because the
ASN.1 parser didn't handle ASN.1 CHOICE types properly, which could result in
an infinite loop when parsing X.509 extensions that use such types.

This vulnerability has been registered as CVE-2017-9023 [3].
Please refer to our blog for details. [4]

[1] https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-9022
[2]
https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-(cve-2017-9022).html
[3] https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-9023
[4]
https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-(cve-2017-9023).html

-- 
You are receiving this mail because:
You are the assignee for the bug.